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Amendments to the Claims: 

The listing of claims will replace all prior versions, and listings, of claims in the 

application. 

Listing of Claims: 

1-15. (Canceled). 

16. (Currently Amended) A method for performing a safety analysis in a system of a motor 
vehicle, the system including a plurality of components linked by communication 
relationships, the components and the communication relationships forming a functional 
structure of the system, the method comprising: 

determining errors as a function of the functional structure; [[and]] 
analyzing error dependencies with respect to the functional structure; 
tracking the error dependencies in the functional structure; 
determining global effects of the errors: 

determining errors which cause a malfunction of a component or a communication 
relationship; 

determining measures for at least one of error detection and error control; 

determining an achievable safety level and comparing the determined safety level 
with the selected safety level; and 

restarting the method at the tracking as a function of the comparison until achieving 
the safety level . 

17. (Previously Presented) The method as recited in claim 16, wherein the determining errors 
step includes tracking the error dependencies in the functional structure to generate error 
paths, global effects of the errors being determined as ends of the error paths. 

18. (Previously Presented) The method as recited in claim 16, wherein the determining errors 
step includes tracking the error dependencies in the functional structure to generate error 
paths, global effects of the errors being determined and weighted as ends of the error paths. 

19. (Previously Presented) The method as recited in claim 18, wherein the global effects are 
weighted by determining at least one safety level. 
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20. (Previously Presented) The method as recited in claim 16, further comprising: 

determining errors which cause a malfunction of a component or a communication 
relationship. 

21. (Previously Presented) The method as recited in claim 17, further comprising: 

assigning malfunctions of a component or a communication relationship to the global 

effects. 

22. (Previously Presented) The method as recited in claim 16, further comprising: 

determining measures for at least one of error detection and error control. 

23. (Previously Presented) The method as recited in claim 17, further comprising: 

expanding the functional structure so that at least one of the global effects and a 
malfunction of a component or a communication relationship, are taken into account. 

24. (Previously Presented) The method as recited in claim 16, further comprising: 

expanding the functional structure in such a way that measures are included for at 
least one of error detection and error control. 

25. (Previously Presented) A method for achieving a preselectable safety level in a system in 
a motor vehicle, the system including a plurality of components linked by communication 
relationships, the components and the communication relationships forming a functional 
structure of the system, the method comprising: 

determining errors as a function of the functional structure; 
analyzing error dependencies with respect to the functional structure; 
tracking the error dependencies in the functional structure; 
generating error paths; 
determining global effects of the errors; 

weighting the global effects as a function of a selected safety level; 
determining errors which cause a malfunction of a component or a communication 
relationship; 

assigning the malfunction of a component or a communication relationship to the 
global effects; 

determining measures for at least one of error detection and error control; 



3 



Attorney Docket No. 10191/3800 
U.S. Patent Application No. 10/506,372 
Reply to Final Office Action of April 24, 2008 

determining an achievable safety level and comparing the determined safety level 
with the selected safety level; and 

restarting the method at the tracking step as a function of the comparison until 
achieving the safety level. 

26. (Previously Presented) The method as recited in claim 25, further comprising: 

documenting of the functional structure. 

27. (Currently Amended) The method as recited in claim 16, further comprising: 

representing the functional structure as a CARTRONIC© functional structure using 

UML. 

28. (Currently Amended) A computer system, the computer system programmed for 
performing a safety analysis of a system of a motor vehicle, the system of the motor vehicle 
including a plurality of components linked by communication relationships, the components 
and the communication relationships forming a function structure of the steps, the computer 
system configured to perform the steps of: 

determining errors as a function of the functional structure; and 
analyzing error dependencies with respect to the functional structure; 
tracking the error dependencies in the functional structure; 
determining global effects of the errors; 

determining errors which cause a malfunction of a component or a communication 
relationship; 

determining measures for at least one of error detection and error control; 

determining an achievable safety level and comparing the determined safety level 
with the selected safety level; and 

restarting the method at the tracking as a function of the comparison until achieving 
the safety level . 

29. (Currently Amended) A computer program for performing a safety analysis of a system 
of a motor vehicle, the system of the motor vehicle including a plurality of components 
linked by communication relationships, the components and the communication 
relationships forming a function structure of the steps, the computer program, when executed 
by a computer system, causing the computer system to perform the steps of: 
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determining errors as a function of the functional structure; and 
analyzing error dependencies with respect to the functional structure; 
tracking the error dependencies in the functional structure; 
determining global effects of the errors; 

determining errors which cause a malfunction of a component or a communication 
relationship; 

determining measures for at least one of error detection and error control: 
determining an achievable safety level and comparing the determined safety level 

with the selected safety level: and 

restarting the method at the tracking as a function of the comparison until achieving 

the safety level . 

30. (Currently Amended) A storage device storing computer program for performing a safety 
analysis of a system of a motor vehicle, the system of the motor vehicle including a plurality 
of components linked by communication relationships, the components and the 
communication relationships forming a function structure of the steps, the computer 
program, when executed by a computer, causing the computer to perform the steps of: 

determining errors as a function of the functional structure; and 

analyzing error dependencies with respect to the functional structure; 

tracking the error dependencies in the functional structure; 

determining global effects of the errors; 

determining errors which cause a malfunction of a component or a communication 
relationship; 

determining measures for at least one of error detection and error control; 

determining an achievable safety level and comparing the determined safety level 
with the selected safety level; and 

restarting the method at the tracking as a function of the comparison until achieving 
the safety level . 
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